What Is OLLVM Deobfuscation and How Is It Supported in the Reverse-Skill Repository

OLLVM deobfuscation is the process of reversing Obfuscator-LLVM transformations—control-flow flattening, bogus control flow, and instruction substitution—to restore analyzable binary code, supported in the reverse-skill repository through a curated three-stage workflow documented in skills/reverse-engineering/references/ollvm-deobfuscation.md.

The reverse-skill repository provides an up-to-date, community-curated knowledge base for analysts confronting binaries protected by OLLVM (Obfuscator-LLVM). Understanding how to systematically dismantle these protections requires familiarity with the underlying obfuscation passes and the specific tools mapped out in the repository's routing logic.

Understanding OLLVM Obfuscation Techniques

OLLVM operates as a set of LLVM intermediate representation (IR) passes that deliberately harden binaries through three core transformations. According to the pattern definitions in skills/reverse-engineering/patterns.md, each pass targets a specific analysis vector used by reverse engineers.

Control-Flow Flattening (fla)

The fla pass rewrites functions into a dispatcher loop architecture. A state variable determines the next basic block to execute, transforming structured code into a star-shaped control-flow graph (CFG). As noted in the "控制流平坦化" section of the reference documentation, this elimination of structured control flow forces analysts to reconstruct the original logic from a flattened state machine.

Bogus Control Flow (bcf)

The bcf pass inserts never-taken branches guarded by opaque predicates—conditions that always evaluate to true or false but appear uncertain to static analysis. The "虚假控制流" section explains how this inflates dead code and pollutes the CFG with artificial complexity, consuming analyst time on unreachable paths.

Instruction Substitution via MBA (sub)

The sub pass replaces simple arithmetic and bitwise operations with equivalent but convoluted Mixed Boolean-Arithmetic (MBA) expressions. Detailed in the "指令替换" section, this transformation preserves semantic correctness while defeating pattern-based decompilation and constant propagation.

The Three-Stage OLLVM Deobfuscation Workflow

The repository organizes OLLVM deobfuscation into a systematic pipeline that accounts for the diversity of modern forks and target architectures.

Stage 1: Identify the OLLVM Variant

Different OLLVM forks—including Hikari, O-MVLL, Pluto, and Polaris—expose distinct signatures and implementation quirks. The "现代 OLLVM 变种生态" table in skills/reverse-engineering/references/ollvm-deobfuscation.md provides detection cues such as dispatcher prologue patterns and state variable initialization sequences. Accurate variant identification is critical because it determines which un-flattener algorithms and opaque predicate solvers will be effective.

Stage 2: Select the Appropriate Tool

The repository's "0. 快速决策：我该用哪个工具？" decision matrix maps your analysis environment and target architecture to specific utilities:

• obpo-plugin: A cloud-based Hex-Rays microcode plugin offering the most powerful deobfuscation but requiring network access to proprietary services.
• d810-ng: A local IDA Pro plugin combining Z3-SMT solving with specialized un-flatteners tailored to each OLLVM variant.
• ollvm-unflattener: A pure-Python Miasm-based symbolic executor for x86/x64 scripted analysis.
• ollvm-breaker: A Binary Ninja plugin optimized for Android .so binaries.
• deollvm: A Unicorn-based emulator specifically designed for ARM64 deflatting.
• angr: A generic Python symbolic-execution framework suitable for CTF-style rapid analysis.

Stage 3: Apply the Layered Deobfuscation Pipeline

The "完整脱密工作流" flowchart recommends applying transformations in a specific order to maximize effectiveness:

1. Remove opaque predicates (bcf mitigation) using d810-ng or obpo-plugin to eliminate dead code.
2. Unflatten control flow (fla mitigation) using variant-specific un-flatteners such as UnflattenerSwitchCase for Tigress-style dispatchers.
3. Simplify MBA expressions (sub mitigation) using the d810-ng MBA simplifier or dedicated tools like SiMBA.

Each stage includes verification steps—size reduction metrics, CFG simplification checks, and dynamic validation with Frida—to confirm that semantic equivalence has been preserved.

Practical Deobfuscation Examples

The repository includes concrete implementation patterns for applying these tools against real-world binaries.

Quick Analysis with angr

For CTF scenarios or rapid triage, the skills/reverse-engineering/references/ollvm-deobfuscation.md file provides a Python script targeting the five largest functions (typically the obfuscated entry points):

import angr

proj = angr.Project("challenge.so", auto_load_libs=False)
cfg = proj.analyses.CFGFast()

# Pick the five largest functions – they are likely obfuscated

funcs = sorted(cfg.functions.values(), key=lambda f: f.size, reverse=True)[:5]
for func in funcs:
    print(f"[+] {func.name} @ {hex(func.addr)} size={hex(func.size)}")
    try:
        deob = proj.analyses.Deobfuscator(func=func)
        deob.normalize()
        print("    [+] deobfuscated")
    except Exception as e:
        print(f"    [-] failed: {e}")

This approach leverages angr's generic deobfuscation passes to normalize control flow without variant-specific tuning.

IDA Pro Integration with d810-ng

For production-grade analysis, the repository documents integration with d810-ng:

git clone https://github.com/w00tzenheimer/d810-ng.git

Copy the plugin directory into IDA's plugins folder, then open your target binary. Press Ctrl-Shift-D to invoke the control panel, enable the desired rule set (MBA simplification, opaque-predicate removal, and un-flattening), and apply it to the selected function. Save the IDB and verify that the CFG has collapsed from a star-shaped dispatcher layout to a linear tree structure, indicating successful restoration of the original control flow.

Scripted Unflattening with ollvm-unflattener

For automated pipelines or x86/x64-specific batch processing, the ollvm-unflattener tool provides a Miasm-based solution:

git clone https://github.com/cdong1012/ollvm-unflattener.git
cd ollvm-unflattener
pip install -r requirements.txt      # miasm, graphviz, keystone-engine

python unflattener -i target.bin -o deobf.bin -t 0x401000 -a

This performs symbolic execution locally to resolve state variable transitions and reconstruct the original basic block relationships without requiring a full IDA installation.

Key Repository Files for OLLVM Deobfuscation

The reverse-skill ecosystem organizes OLLVM knowledge across several authoritative files:

• skills/reverse-engineering/references/ollvm-deobfuscation.md: The central reference containing variant taxonomy, detection cues, the complete tool matrix, and the full three-stage workflow.
• skills/routing.md: Maps the "OLLVM-obfuscated binary" capability to the above reference, enabling automated routing of queries to the appropriate knowledge base.
• skills/reverse-engineering/tools-advanced.md: Lists OLLVM-related deobfuscation frameworks with comparative strengths (e.g., d810-ng's SMT integration versus obpo-plugin's cloud microcode optimization).
• skills/reverse-engineering/patterns.md: Describes the underlying obfuscation patterns (fla, bcf, sub) that define the adversary model for all deobfuscation tooling.

Summary

• OLLVM deobfuscation requires reversing three specific transformations: control-flow flattening (fla), bogus control flow (bcf), and MBA-based instruction substitution (sub).
• The reverse-skill repository supports this through a documented workflow in skills/reverse-engineering/references/ollvm-deobfuscation.md covering variant detection, tool selection, and layered pipeline application.
• Tool selection depends on your environment: use d810-ng for local IDA Pro work, obpo-plugin for maximum decompiler integration, ollvm-unflattener for Python-based x86/x64 scripting, and deollvm for ARM64 Android targets.
• Pipeline order matters: remove opaque predicates first, unflatten control flow second, and simplify MBA expressions last to avoid analysis errors.

Frequently Asked Questions

What are the main differences between OLLVM variants like Hikari, O-MVLL, and Pluto?

Each variant implements the core fla, bcf, and sub passes with distinct signatures. Hikari focuses on iOS/macOS compatibility with anti-debug features, O-MVLL targets mobile architectures with updated LLVM backends, and Pluto introduces VM-style flattening with indirect branches. The "现代 OLLVM 变种生态" table in skills/reverse-engineering/references/ollvm-deobfuscation.md provides specific detection heuristics for each, ensuring you select the correct un-flattener algorithm.

Can OLLVM deobfuscation be fully automated for unknown binaries?

Full automation remains challenging due to the diversity of state variable implementations and the potential for nested obfuscation passes. While tools like obpo-plugin and d810-ng automate significant portions of the workflow, analysts must typically verify variant identification manually and validate output with dynamic instrumentation (e.g., Frida) to ensure semantic preservation.

Which tool should I use for Android ARM64 binaries protected by OLLVM?

For Android ARM64 targets, the repository recommends deollvm (a Unicorn-based emulator specifically designed for ARM64 deflatting) or ollvm-breaker (a Binary Ninja plugin optimized for .so files). If you are working within IDA Pro, d810-ng also supports ARM64 but may require manual configuration of the un-flattener rules for specific dispatcher patterns.

How does d810-ng differ from generic symbolic execution approaches like angr?

d810-ng is specialized for OLLVM deobfuscation within IDA Pro, integrating Z3-SMT solving with hand-tuned un-flatteners for specific variants (e.g., Tigress-style switch-case dispatchers). In contrast, angr provides generic symbolic execution suitable for rapid CTF analysis but may struggle with complex MBA simplification and variant-specific dispatcher logic without custom scripts. Use d810-ng for production reverse engineering and angr for quick triage or automated CTF solutions.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}